Unauthenticated attackers can trigger a denial of service condition in OpenClaw by sending malicious request bodies to webhook endpoints before authentication occurs.

This vulnerability (CWE-770) exists because the application performs resource-intensive request body parsing before validating authentication or signatures. An unauthenticated attacker can exploit this by sending slow or oversized payloads to exhaust server resources.

The exploitation of this vulnerability leads to a denial of service, rendering the affected webhook integrations for Google Chat and BlueBubbles unavailable. Given the CVSS score of 7.5, this high severity flaw poses a significant risk to operational continuity, as it allows any remote attacker to disrupt critical communication workflows without requiring valid credentials.

Immediate Action: Update the OpenClaw package to version 2026.3.2 or later to implement proper resource limits and authentication checks.

Proactive Monitoring: Monitor server logs for an unusual spike in large or slow HTTP requests directed at webhook endpoints, which may indicate an ongoing exploitation attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an API gateway to enforce request size limits and rate limiting for incoming webhook traffic until the update can be applied.

Public Exploit Available: Unknown (there is no confirmed public exploit in the available data).

The risk of service disruption from this denial of service vulnerability is substantial given that the endpoint is reachable by any unauthenticated remote user. Organizations utilizing OpenClaw for Google Chat or BlueBubbles integrations should prioritize the update to version 2026.3.2 immediately to ensure that webhook parsers are protected by proper authentication and resource management.